Firewall: rule-based traffic filter

A firewall acts as a gatekeeper for your network, inspecting incoming and outgoing data packets and allowing or blocking them based on a set of predefined rules. For example, it might block all traffic from a suspicious IP address or prevent unauthorised outbound connections from malware. Unlike antivirus software, a firewall does not scan files for viruses or remove infections; it only controls the flow of traffic, so it is a first line of defence, not a complete security solution.

When tackling exam questions, remember that a firewall cannot enforce password policies, manage user authentication, or patch software vulnerabilities. If a scenario describes an employee clicking a phishing link, a firewall alone would not stop the malware from executing once the connection is allowed. Also, a firewall does not encrypt data; for that you need a VPN or HTTPS. A useful trick is to think of a firewall as a bouncer checking IDs at the door, not a security guard inside the building.

To test your understanding, ask yourself: if a threat bypasses the firewall because the rule allows the traffic, what other controls would catch it? The answer is patching, MFA, and user awareness. Remember: firewall filters, but does not fix; it reduces exposure, not risk entirely.